在我的 Centos 6.4 服务器中，我使用 Postfix 和 Dovecot 以及 Amavis/ClamAV 过滤器。最近我一直在尝试解决垃圾邮件问题（仅发生在 Gmail 和 Hotmail 中），因此我一直在跟踪日志。
虽然我可以发送和接收电子邮件，但我意识到 Clamav 会导致 /var/log/maillog 中出现错误，因此我想如果我能解决这个错误，也许可以帮助我解决垃圾邮件问题。
这是主要的错误，我认为其余的过程一切顺利。
(!)connect to /var/run/clamav/clamd.sock failed, attempt #1: Can't connect to UNIX socket /var/run/clamav/clamd.sock: No such file or directory
测试信息：
XX.XX.XX.XX: Sender Client IP (This time Thunderbird)
YY.YY.YY.YY: My mail server IP
[email protected]: Sender address
[email protected]: Receiver address (This time Gmail)
当我从服务器中的邮件帐户发送电子邮件时，/var/log/maillog 如下所示：
postfix[3422]: warning: XX.XX.XX.XX: hostname XX.XX.XX.XX.static.ttnet.com.tr verification failed: Name or service not known
postfix[3422]: connect from unknown[XX.XX.XX.XX]
postfix[3422]: setting up TLS connection from unknown[XX.XX.XX.XX]
postfix[3422]: Anonymous TLS connection established from unknown[XX.XX.XX.XX]: TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)
postfix[3422]: D894AC1E61: client=unknown[XX.XX.XX.XX], sasl_method=PLAIN, [email protected]
postfix/cleanup[3429]: D894AC1E61: message-id=<[email protected]>
postfix/qmgr[1310]: D894AC1E61: from=<[email protected]>, size=862, nrcpt=1 (queue active)
amavis[3326]: (03326-01) ESMTP::10024 /var/amavis/tmp/amavis-20131030T102202-03326-IY7b8Pdi: <[email protected]> -> <[email protected]> SIZE=862 Received: from host.mydomain.com ([127.0.0.1]) by localhost (mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <[email protected]>; Wed, 30 Oct 2013 10:22:02 +0000 (UTC)
amavis[3326]: (03326-01) Checking: MemHkAhbAuqt [XX.XX.XX.XX] <[email protected]> -> <[email protected]>
amavis[3326]: (03326-01) Open relay? Nonlocal recips but not originating: [email protected]
amavis[3326]: (03326-01) (!)connect to /var/run/clamav/clamd.sock failed, attempt #1: Can't connect to UNIX socket /var/run/clamav/clamd.sock: 2
amavis[3326]: (03326-01) ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamav/clamd.sock, retrying (1)
postfix[3422]: disconnect from unknown[XX.XX.XX.XX]
amavis[3326]: (03326-01) (!)connect to /var/run/clamav/clamd.sock failed, attempt #1: Can't connect to UNIX socket /var/run/clamav/clamd.sock: No such file or directory
amavis[3326]: (03326-01) (!)ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamav/clamd.sock, retrying (2)
amavis[3326]: (03326-01) (!)connect to /var/run/clamav/clamd.sock failed, attempt #1: Can't connect to UNIX socket /var/run/clamav/clamd.sock: No such file or directory
amavis[3326]: (03326-01) (!)ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk to /var/run/clamav/clamd.sock (All attempts (1) failed connecting to /var/run/clamav/clamd.sock) at (eval 113) line 600.\n
amavis[3326]: (03326-01) (!)WARN: all primary virus scanners failed, considering backups
postfix[3433]: connect from unknown[127.0.0.1]
postfix[3433]: E52C1C1E71: client=unknown[127.0.0.1]
postfix/cleanup[3429]: E52C1C1E71: message-id=<[email protected]>
postfix/qmgr[1310]: E52C1C1E71: from=<[email protected]>, size=1279, nrcpt=1 (queue active)
amavis[3326]: (03326-01) FWD from <[email protected]> -> <[email protected]>,BODY=7BIT 250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as E52C1C1E71
amavis[3326]: (03326-01) Passed CLEAN {RelayedOpenRelay}, [XX.XX.XX.XX]:33926 [XX.XX.XX.XX] <[email protected]> -> <[email protected]>, Message-ID: <[email protected]>, mail_id: MemHkAhbAuqt, Hits: 0.106, size: 862, queued_as: E52C1C1E71, 14736 ms
postfix/smtp[3430]: D894AC1E61: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=15, delays=0.53/0.01/0.01/15, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as E52C1C1E71)
postfix/qmgr[1310]: D894AC1E61: removed
amavis[3326]: (03326-01) extra modules loaded: unicore/lib/gc_sc/Digit.pl, unicore/lib/gc_sc/SpacePer.pl
postfix/smtp[3436]: E52C1C1E71: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[74.125.142.27]:25, delay=1.2, delays=0.01/0.02/0.68/0.5, dsn=2.0.0, status=sent (250 2.0.0 OK 1383128540 x12si3704513igx.15 - gsmtp)
postfix/qmgr[1310]: E52C1C1E71: removed
dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=3439, secured
dovecot: imap([email protected]): Disconnected: Logged out bytes=90/777
以下是Gmail接收邮件的源代码：
Delivered-To: [email protected]
Received: by 10.68.54.102 with SMTP id i6csp217498pbp;
Wed, 30 Oct 2013 03:22:20 -0700 (PDT)
X-Received: by 10.50.6.99 with SMTP id z3mr1702938igz.27.1383128540254;
Wed, 30 Oct 2013 03:22:20 -0700 (PDT)
Return-Path: <[email protected]>
Received: from host.mydomain.com (mydomain.com. [YY.YY.YY.YY])
by mx.google.com with ESMTPS id x12si3704513igx.15.2013.10.30.03.22.19
for <[email protected]>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Wed, 30 Oct 2013 03:22:20 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates YY.YY.YY.YY as permitted sender) client-ip=YY.YY.YY.YY;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates YY.YY.YY.YY as permitted sender) [email protected]
Received: from localhost (unknown [127.0.0.1])
by host.mydomain.com (Postfix) with ESMTP id E52C1C1E71
for <[email protected]>; Wed, 30 Oct 2013 10:22:16 +0000 (UTC)
X-Virus-Scanned: amavisd-new at mydomain.com
Received: from host.mydomain.com ([127.0.0.1])
by localhost (mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id MemHkAhbAuqt for <[email protected]>;
Wed, 30 Oct 2013 10:22:02 +0000 (UTC)
Received: from [192.168.2.15] (unknown [XX.XX.XX.XX])
(using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
(No client certificate requested)
by host.mydomain.com (Postfix) with ESMTPSA id D894AC1E61
for <[email protected]>; Wed, 30 Oct 2013 10:22:01 +0000 (UTC)
Message-ID: <[email protected]>
Date: Wed, 30 Oct 2013 12:21:47 +0200
From: mydomain Development Base <[email protected]>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.0
MIME-Version: 1.0
To: [email protected]
Subject: That's the mail
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font face="Helvetica, Arial, sans-serif">What's up?</font>
</body>
</html>
虽然一切看起来都很好，而且已经通过了 amavisd-new 的扫描，但它还是被归类为垃圾邮件。我不一定非要问为什么，但如果这与扫描不正确有关，我就需要解决这个问题。
以下是我在 /etc/amavisd.conf 文件中使用 CLAMAV 的方法：
['ClamAV-clamd',
\&ask_daemon, ["CONTSCAN {}\n", "/var/run/clamav/clamd.sock"],
qr/\bOK$/m, qr/\bFOUND$/m,
qr/^.*?: (?!Infected Archive)(.*) FOUND$/m ],
/var/run/clamav/ 目录下不存在文件 clamd.sock，并且此目录由 clamav 用户和组拥有（不存在时服务不会启动）。我不知道它是否是一个在运行时创建和删除的动态文件，但我认为权限没有任何问题，也许缺少创建文件的某个进程或服务。
有什么想法吗？提前致谢。
答案1
您需要确保已将 clamd 配置为在 amavisd（在 /etc/amavisd.conf 中）和 clamd（/etc/clamd.conf）中以相同的方式提供套接字，否则它们将无法通信。
答案2
当机器没有足够的 RAM 时，可能会出现此错误，似乎 1GB 在 Debian 11 上不够用。